Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Advisory: Adobe ColdFusion — helpx.adobe.com/security/products/coldfusion/apsb25-105.html Clear all filters
TI-2025-38197 CVE-2025-61808 · GHSA-g96j-73c3-2r7f

ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)

Priority MEDIUM 54

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to arbitrary code execution by a high priviledged attacker.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.10562 Published 2025-12-09 No fix listed CWE-434
TI-2025-38201 CVE-2025-61812 · GHSA-47gj-rgp2-78f7

ColdFusion | Improper Input Validation (CWE-20)

Priority MEDIUM 46

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could allow a high privileged attacker to gain arbitrary code execution.

CVSS 3.1HIGH 8.4 Adjacent network High privileges No interaction EPSS 0.04706 Published 2025-12-09 No fix listed CWE-20
TI-2025-40173 CVE-2025-64898 · GHSA-q76w-cpf4-58gv

ColdFusion | Insufficiently Protected Credentials (CWE-522)

Priority LOW 26

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited unauthorized write access.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00438 Published 2025-12-09 No fix listed CWE-522
TI-2025-38199 CVE-2025-61810 · GHSA-cjmh-96m9-g6qr

ColdFusion | Deserialization of Untrusted Data (CWE-502)

Priority MEDIUM 50

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.09545 Published 2025-12-09 No fix listed CWE-502
TI-2025-38198 CVE-2025-61809 · GHSA-5mvc-x488-xrpc

ColdFusion | Improper Input Validation (CWE-20)

Priority MEDIUM 48

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00661 Published 2025-12-09 No fix listed CWE-20
TI-2025-38211 CVE-2025-61822 · GHSA-8r3x-4gr3-hxhv

ColdFusion | Improper Input Validation (CWE-20)

Priority LOW 29

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system write.

CVSS 3.1MEDIUM 6.2 Adjacent network High privileges No interaction EPSS 0.0065 Published 2025-12-09 No fix listed CWE-20
TI-2025-40172 CVE-2025-64897 · GHSA-mjw5-6w2m-jr5w

ColdFusion | Improper Access Control (CWE-284)

Priority LOW 26

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability.

CVSS 3.1MEDIUM 5.6 Local Low privileges User interaction EPSS 0.0013 Published 2025-12-09 No fix listed CWE-284